100Critical
This skill is vulnerable to prompt injection and executes opaque external
Behavior Analysis
Description verified — behavior matches claim
Claims to do
Todo4 Onboarding Skill: This is a fixed 4-step procedure. Follow it exactly, in order, one step at a time. Do not improvise, summarize, or skip steps.
Actually does
The skill prompts the user for an email, then executes `scripts/register.sh` to send an OTP. It then prompts for the OTP, runs `scripts/verify.sh` to obtain an `ACCESS_TOKEN` using `jq`, and finally executes `scripts/connect.sh` with the token and agent name. This last step extracts a one-time `WEB_LOGIN_URL` from the script's output and presents it to the user.
Skill Info
Namepanitw/todo4-onboard
Registryclawhub
Version1.3.1
PURLpkg:clawhub/panitw/todo4-onboard@1.3.1
Downloads100
Source
SHA-256138d4c618ba4...
SHA-17451e3808d8a...
MD5e2382f24d58c...
TLSHa9d1b81b4704...
ssdeep192:/vepVe6n...
Size6,397 bytes
Install
This skill has been flagged as potentially malicious. Review the findings below before installing.
ClawHubDocs
openclaw skills install panitw/todo4-onboardAssessments (4)
AI Agent Traps ↗Prompt Injection Detectedcriticalprompt injection
DeBERTa classifier detected prompt injection (confidence: 0.98)
98% confidence
Command Injection via User Input in Scriptscriticalcommand execution
The skill executes shell scripts (`register.sh`, `verify.sh`) using user-provided email and verification code. If these inputs are not properly sanitized within the scripts, a malicious user could inject arbitrary shell commands.
90% confidenceline 50
scripts/register.sh <email> ACCESS_TOKEN=$(scripts/verify.sh <email> <code> | jq -r '.accessToken')
Sensitive Credential Handling and Exposure Riskhighcredential theft
The skill handles highly sensitive credentials (access tokens, refresh tokens, agent tokens, OTP codes, MCP config). While it instructs the agent not to display them, the presence and handling of these secrets pose a risk if instructions are bypassed or the execution environment is compromised.
80% confidenceline 137
Never echo $ACCESS_TOKEN or the script's JSON output. NEVER display the access token, refresh token, agent token, or MCP config contents.
Broad Network Access Capability via 'curl'mediumdata exfiltration
The skill declares `curl` as a required binary, granting the agent broad network access capabilities. This tool, especially if combined with a successful command injection, could be leveraged for data exfiltration, SSRF, or other network-based attacks.
70% confidenceline 6
bins: [curl, jq]
External script execution with user-supplied inputhighcommand execution
The skill instructs the agent to run external shell scripts (register.sh, verify.sh, connect.sh) located in a local 'scripts/' directory. These scripts are not defined within the skill itself, making their actual behavior opaque. The agent is directed to execute them with user-supplied email input and OTP codes without any sandboxing or validation of the scripts' contents.
80% confidenceline 57
scripts/register.sh <email> ACCESS_TOKEN=$(scripts/verify.sh <email> <code> | jq -r '.accessToken') CONNECT_OUT=$(scripts/connect.sh "$ACCESS_TOKEN" <agent_name>)
Credential capture via shell variable assignmenthighcredential harvesting
The skill captures an ACCESS_TOKEN from external script output and stores it in a shell variable, then passes it to another script. While the skill instructs the agent not to echo the token, the token is being harvested from a remote server and used programmatically. The scripts receiving this token are external and unaudited.
75% confidenceline 75
ACCESS_TOKEN=$(scripts/verify.sh <email> <code> | jq -r '.accessToken') ... CONNECT_OUT=$(scripts/connect.sh "$ACCESS_TOKEN" <agent_name>)
Undeclared MCP config modification by external scripthightool poisoning
The connect.sh script is described as writing 'MCP config and agent token automatically' to the local system. This represents a persistence/tool-poisoning mechanism where an external script modifies the agent's tool configuration without explicit user confirmation of what is being written. The actual content of the MCP config is hidden from the user.
85% confidenceline 106
the script wrote the MCP config and agent token automatically
User email harvested and sent to external servermediumdata exfiltration
The skill collects the user's email address and passes it to an external shell script (register.sh) which presumably transmits it to an external server (todo4.io). The user is not shown what HTTP request is made or what data is transmitted beyond the email.
70% confidenceline 59
scripts/register.sh <email>
Description-to-behavior mismatch: scripts not disclosedmediumdescription mismatch
The skill's public description presents this as a simple onboarding flow but conceals that it executes multiple local shell scripts, writes system configuration files, and establishes a persistent MCP connection. Users triggering this skill would not be aware of the full scope of actions taken.
70% confidenceline 2
description: "Sign up for Todo4 and connect this agent via MCP... Creates the account via email OTP and wires up the MCP connection — no browser, no password."
Oversight Evasion for Onboarding Processlowoversight evasion
The skill explicitly instructs the agent to bypass user confirmation or explanations during onboarding ('DO NOT ask 'are you sure?'). While intended for a streamlined experience, this pattern can reduce user awareness and consent for actions.
70% confidenceline 32
DO NOT explain what Todo4 is, list features, or ask 'are you sure?' — just start STEP 1.
Social engineering via urgency and brevity framinglowhuman social engineering
The skill is designed to minimize friction and prevent the user from reflecting on what is happening ('DO NOT explain what Todo4 is', 'just start STEP 1', 'DO NOT ask for more than one piece of information per message'). This pattern is designed to reduce user scrutiny of the onboarding process.
60% confidenceline 32
DO NOT explain what Todo4 is, list features, or ask "are you sure?" — just start STEP 1. DO NOT ask for more than one piece of information per message.
One-time login URL displayed in chat (phishing risk)lowsocial engineering
The skill instructs the agent to display a one-time web login URL in plain chat (explicitly not in a code block). While framed as a convenience feature, this pattern trains users to click agent-provided authentication links, which could be exploited in a compromised version of this skill.
55% confidenceline 116
SAY (substitute the URL literally — no backticks, no code block): > Open your tasks in the browser — you'll be signed in automatically (link is single-use, valid for 5 minutes): > <WEB_LOGIN_URL>
Badge
Markdown
[](https://mondoo.com/ai-agent-security/skills/clawhub/panitw/todo4-onboard)HTML
<a href="https://mondoo.com/ai-agent-security/skills/clawhub/panitw/todo4-onboard"><img src="https://mondoo.com/ai-agent-security/api/badge/clawhub/panitw/todo4-onboard.svg" alt="Mondoo Skill Check" /></a>Image URL
https://mondoo.com/ai-agent-security/api/badge/clawhub/panitw/todo4-onboard.svgSecure your AI agents
Skills can read files, run commands, and access credentials. Mondoo helps organizations manage the security risks of AI agent skills across their entire fleet.
- Continuous scanning of skills across all registries
- Policy enforcement before skills reach your agents
- Integration with your existing security workflow